Better test coverage for MPC context lifecycle (PR 3/7)

[dvdplm]

Stacked upon #804, hence the draft status.

Test and fix MPC context write operations ordering across persistent storage and in-memory state.

Before this PR, a failed centralized context creation could leave the cache state out of sync with storage. A failed threshold context deletion removed the context from the session maker before storage deletion succeeded, which made the operation difficult to retry.

This PR:

• Serializes MPC context creation and destruction by way of a mutex.
• Updates to cache or session state happen only after the primary storage result is known.
• Keeps a stored context registered when backup synchronization fails.
• Keeps a context registered when deletion fails before mutation, so deletion remains retryable.
• Accepts a deletion error when storage confirms that the context is gone.
• Removes a newly stored context if threshold session registration fails.
• Tests the normalized centralized and threshold behavior, including restart, duplicate creation, lock acquisition and before/after-mutation failures.

Part of https://github.com/zama-ai/kms-internal/issues/3183.

[Copilot]

Pull request overview

This PR improves correctness and test coverage around MPC context lifecycle operations (create/destroy) and paired public/private CryptoMaterialStorage::write_all behavior, specifically to keep persistent storage and in-memory/cache/session state consistent and make failures retryable.

Changes:

• Introduces test support utilities (storage entry identifiers, event recording, and fault phases) plus a new fault-injecting FailingRamStorage to precisely model before/after-mutation failures.
• Refactors CryptoMaterialStorage::write_all to track per-half write outcomes, avoid purging pre-existing entries on partial failures, and propagate richer store outcomes internally.
• Updates context manager lifecycle flows to serialize existence-check + update via a mutex, reorder storage vs cache/session mutations for retryability, and add regression tests for failure modes (including confirmed deletes and backup failures).

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
core/threshold-execution/src/online/reshare.rs	Minor formatting adjustment in a reshare test helper (brace line changed).
core/service/src/vault/storage/test_support.rs	Adds shared test-only types for storage entry identification, fault phases, event/outcome recording, and event comparison.
core/service/src/vault/storage/ram/failing.rs	Adds a new test-only FailingRamStorage wrapper with entry-specific fault injection and event/state tracking.
core/service/src/vault/storage/ram.rs	Wires the new FailingRamStorage test module and removes the previous test-only failing storage implementation.
core/service/src/vault/storage/mod.rs	Exposes the new test_support module under cfg(test).
core/service/src/vault/storage/crypto_material/tests/storage_side_effects/support.rs	Adds fixtures/helpers for paired pub/priv write_all side-effect testing.
core/service/src/vault/storage/crypto_material/tests/storage_side_effects/cases.rs	Adds parameterized tests validating rollback and preservation semantics for paired writes and context-info writes.
core/service/src/vault/storage/crypto_material/tests/storage_side_effects.rs	Adds the test module entrypoint for write_all side-effect tests.
core/service/src/vault/storage/crypto_material/tests/migration.rs	Adjusts migration tests to the updated threshold storage setup helper signature.
core/service/src/vault/storage/crypto_material/tests.rs	Updates tests to new failure injection approach and to the updated write APIs/outcomes; adds storage_side_effects module.
core/service/src/vault/storage/crypto_material/mod.rs	Re-exports StorageError for broader in-crate use (e.g., context manager logic).
core/service/src/vault/storage/crypto_material/base.rs	Refactors write_all and related helpers to track store outcomes and purge only newly-created entries; returns StoreWriteOutcome from internal store helpers.
core/service/src/engine/threshold/service/epoch_manager/tests/failed_reshare.rs	Adds regression tests for failed reshare rollback semantics and retry state retention.
core/service/src/engine/threshold/service/epoch_manager.rs	Updates epoch-manager tests to new failing storage behavior and adds the failed-reshare test module.
core/service/src/engine/context_manager/tests/lifecycle_side_effects/support.rs	Adds fixtures for MPC context create/destroy lifecycle failure tests with storage/session/cache state assertions.
core/service/src/engine/context_manager/tests/lifecycle_side_effects/cases.rs	Adds lifecycle side-effect tests covering failures, retries, locking/serialization, backup failures, and session rollback.
core/service/src/engine/context_manager/tests/lifecycle_side_effects.rs	Adds the test module entrypoint for context lifecycle side-effect tests.
core/service/src/engine/context_manager.rs	Serializes lifecycle updates with a mutex; reorders storage vs cache/session mutations; adds “confirmed delete” handling and supporting helpers.
ai-docs/ARCHITECTURE.md	Documents paired write semantics and updated lifecycle/rollback expectations.

Suppressed comments (1)

core/service/src/vault/storage/test_support.rs:18

• Minor grammar issue in the doc comment: "(is used for every epoch)" should be "(they are used for every epoch)".

/// Public halves have no epoch (is used for every epoch). Each private half has an epoch and contains the party's
/// material for that epoch.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.